yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #2285 from wazuh/change/2283-create-certificates-scripts

Browse Source 
Certificates configuration script
This commit is contained in:
Gonzalo Acuña
2026-04-01 14:38:33 -03:00
committed by GitHub
parent 40b07a62b8 5745995e5c
commit 0eb0d7914f
9 changed files with 208 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/5_pr_check.yml
+2 -2
View File
@@ -149,7 +149,7 @@ jobs:
dns: "wazuh.dashboard"
EOF
cat config.yml
bash ./wazuh-certs-tool.sh -A
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
sudo sysctl -w vm.max_map_count=262144
working-directory: ./single-node
@@ -430,7 +430,7 @@ jobs:
dns: "wazuh.dashboard"
EOF
cat config.yml
bash ./wazuh-certs-tool.sh -A
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
sudo sysctl -w vm.max_map_count=262144
working-directory: ./multi-node
.gitignore
+2
View File
@@ -6,11 +6,13 @@ single-node/wazuh-certificates/*
single-node/wazuh-certificates-tool.log
single-node/wazuh-certs-tool*.sh
single-node/config*.yml
single-node/config
multi-node/wazuh-certificates
multi-node/wazuh-certificates/*
multi-node/wazuh-certificates-tool.log
multi-node/wazuh-certs-tool*.sh
multi-node/config*.yml
multi-node/config/wazuh*
# Documentation
docs/book/
CHANGELOG.md
+1
View File
@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
### Changed
- Certificates configuration script. ([#2285](https://github.com/wazuh/wazuh-docker/pull/2285))
- Modify artifact URLs file name. ([#2266](https://github.com/wazuh/wazuh-docker/pull/2266))
- Use URL signing script to generate presigned internal package URLs. ([#2259](https://github.com/wazuh/wazuh-docker/pull/2259))
- Updated wazuh-docker documentation config and tooling versions to meet new standards. ([#2264](https://github.com/wazuh/wazuh-docker/pull/2264))
docs/ref/getting-started/deployment/multi-node.md
+1 -1
View File
@@ -57,7 +57,7 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
5. Run the certificate creation script:
```bash
bash ./wazuh-certs-tool.sh -A
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
```
6. Start the Wazuh environment using `docker compose`:
docs/ref/getting-started/deployment/single-node.md
+12 -12
View File
@@ -29,30 +29,30 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
```yaml
nodes:
# Wazuh indexer server nodes
indexer:
# Wazuh indexer server nodes
indexer:
- name: wazuh.indexer
dns: "wazuh.indexer"
dns: "wazuh.indexer"
# Wazuh manager nodes
# Use node_type only with more than one Wazuh manager
manager:
# Wazuh manager nodes
# Use node_type only with more than one Wazuh manager
manager:
- name: wazuh.manager
dns: "wazuh.manager"
dns: "wazuh.manager"
# Wazuh dashboard node
dashboard:
# Wazuh dashboard node
dashboard:
- name: wazuh.dashboard
dns: "wazuh.dashboard"
dns: "wazuh.dashboard"
```
5. Run the certificate creation script:
```bash
bash ./wazuh-certs-tool.sh -A
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
```
5. Start the Wazuh environment using `docker compose`:
6. Start the Wazuh environment using `docker compose`:
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
docs/ref/uninstall.md
+6 -12
View File
@@ -10,25 +10,19 @@ This section describes how to uninstall a Wazuh Docker deployment by stopping an
cd <deployment-directory>
```
2. Stop and remove the containers:
2. Stop and remove the containers, persistent volumes and all stored data:
```bash
docker compose down --remove-orphans
docker compose down -v
```
3. Remove persistent volumes and all stored data:
3. Remove generated or downloaded files:
```bash
docker compose down --volumes --remove-orphans
rm -rf wazuh-certificates/ config.yml wazuh-certs-tool.sh config/*/certs
```
4. Remove generated or downloaded files:
```bash
rm -rf wazuh-certificates/ config.yml wazuh-certs-tool.sh
```
5. Verify that the deployment is removed:
4. Verify that the deployment is removed:
```bash
docker ps
@@ -45,7 +39,7 @@ This section describes how to uninstall a Wazuh Docker deployment by stopping an
2. Stop and remove the container:
```bash
docker compose down --remove-orphans
docker compose down
```
3. Verify that the deployment is removed:
multi-node/docker-compose.yml
+20 -20
View File
@@ -40,9 +40,9 @@ services:
- master-wazuh-logs:/var/wazuh-manager/logs
- master-wazuh-queue:/var/wazuh-manager/queue
- master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
- ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
- ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
wazuh.worker:
image: wazuh/wazuh-manager:5.0.0
@@ -81,9 +81,9 @@ services:
- worker-wazuh-logs:/var/wazuh-manager/logs
- worker-wazuh-queue:/var/wazuh-manager/queue
- worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
- ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
- ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
wazuh1.indexer:
image: wazuh/wazuh-indexer:5.0.0
@@ -117,11 +117,11 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
- ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./wazuh-certificates/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./wazuh-certificates/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./wazuh-certificates/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
- ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./config/wazuh1_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
wazuh2.indexer:
image: wazuh/wazuh-indexer:5.0.0
@@ -157,9 +157,9 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
- ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./wazuh-certificates/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
wazuh3.indexer:
image: wazuh/wazuh-indexer:5.0.0
@@ -195,9 +195,9 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
- ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./wazuh-certificates/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
wazuh.dashboard:
image: wazuh/wazuh-dashboard:5.0.0
@@ -227,9 +227,9 @@ services:
- SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
- OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
volumes:
- ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
- ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
- ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
- ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
- ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
depends_on:
single-node/docker-compose.yml
+11 -11
View File
@@ -40,9 +40,9 @@ services:
- wazuh_logs:/var/wazuh-manager/logs
- wazuh_queue:/var/wazuh-manager/queue
- wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
- ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
- ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
wazuh.indexer:
image: wazuh/wazuh-indexer:5.0.0
@@ -75,11 +75,11 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data:/var/lib/wazuh-indexer
- ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./wazuh-certificates/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./wazuh-certificates/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./wazuh-certificates/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
- ./config/wazuh_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./config/wazuh_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
wazuh.dashboard:
image: wazuh/wazuh-dashboard:5.0.0
@@ -109,9 +109,9 @@ services:
- SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
- OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
volumes:
- ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
- ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
- ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
- ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
- ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
depends_on:
tools/utils/deployment/certificates-conf.sh
+153
View File
@@ -0,0 +1,153 @@
#!/bin/bash
# Path configuration (adjust according to your folder structure)
CERT_TOOL="./wazuh-certs-tool.sh"
CONFIG_FILE="./config.yml"
OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default
# Parse arguments
DO_CERT=false
DO_COPY=false
DO_PRIV=false
for arg in "$@"; do
case $arg in
--cert) DO_CERT=true ;;
--copy) DO_COPY=true ;;
--priv) DO_PRIV=true ;;
*)
echo "Unknown option: $arg"
echo "Usage: $0 [--cert] [--copy] [--priv]"
exit 1
;;
esac
done
# If no flags provided, show usage
if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then
echo "Usage: $0 [--cert] [--copy] [--priv]"
echo " --cert Generate certificates using wazuh-certs-tool.sh"
echo " --copy Copy certificates to the corresponding config directories"
echo " --priv Set ownership and permissions on the certificate files"
exit 1
fi
# ---------------------------------------------------------------------------
# Parse config.yml to extract node names per section (indexer, manager, dashboard)
# ---------------------------------------------------------------------------
parse_config() {
local section=""
INDEXER_NODES=()
MANAGER_NODES=()
DASHBOARD_NODES=()
while IFS= read -r line; do
# Detect section headers (e.g., " indexer:", " manager:", " dashboard:")
if echo "$line" | grep -qE '^\s+indexer:\s*$'; then
section="indexer"
continue
elif echo "$line" | grep -qE '^\s+manager:\s*$'; then
section="manager"
continue
elif echo "$line" | grep -qE '^\s+dashboard:\s*$'; then
section="dashboard"
continue
fi
# Extract node name from "- name: <value>" lines
if echo "$line" | grep -qE '^\s+-\s+name:'; then
local name
name=$(echo "$line" | sed 's/.*name:\s*//' | tr -d ' "'\''')
case $section in
indexer) INDEXER_NODES+=("$name") ;;
manager) MANAGER_NODES+=("$name") ;;
dashboard) DASHBOARD_NODES+=("$name") ;;
esac
fi
done < "$CONFIG_FILE"
}
# Convert node name to directory name (replace . with _)
node_to_dir() {
echo "$1" | tr '.' '_'
}
# ---------------------------------------------------------------------------
# Main logic
# ---------------------------------------------------------------------------
# Parse config.yml
if $DO_COPY || $DO_PRIV; then
if [ ! -f "$CONFIG_FILE" ]; then
echo "Error: Configuration file $CONFIG_FILE not found."
exit 1
fi
parse_config
echo "Detected indexer nodes: ${INDEXER_NODES[*]}"
echo "Detected manager nodes: ${MANAGER_NODES[*]}"
echo "Detected dashboard nodes: ${DASHBOARD_NODES[*]}"
fi
# 1. Generate certificates
if $DO_CERT; then
echo "Generating certificates"
bash $CERT_TOOL -A
fi
# 2. Copy certificates to config directories
if $DO_COPY; then
FIRST_INDEXER=true
for node in "${INDEXER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Copying certificates for indexer: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
if $FIRST_INDEXER; then
cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/"
FIRST_INDEXER=false
fi
done
for node in "${MANAGER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Copying certificates for manager: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
done
for node in "${DASHBOARD_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
done
fi
# 3. Set ownership and permissions
if $DO_PRIV; then
for node in "${INDEXER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for indexer $node (1000:1000)"
chown -R 1000:1000 "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
for node in "${MANAGER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for manager $node (999:999)"
chown -R 999:999 "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
for node in "${DASHBOARD_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for dashboard $node (1000:1000)"
chown -R 1000:1000 "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
fi
echo "Process completed."